MediumGHSA-2jfj-6hjv-fm6jCVE-2026-8493329 Sep · 24 days ago
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches.
Does it affect you?
Not read yetConditions are read within the hour after an advisory comes in.
Impact undici's interceptors.cache() does not handle Set-Cookie in the cache path. In shared-cache mode ( type: 'shared' , the default), a cacheable response (for example Cache-Control: public, max-age=... ) carrying a Set-Cookie header is stored, and the stored Set-Cookie is re-served to a later caller that hits the same cache key. This exposes one user's cookie to another caller and lets an untrusted upstream inject cookies into cached responses served to all subsequent callers, violating RFC 6265 section 7.2 (a shared cache must not store cookies). Applications using the shared cache interc
SourcesGitHub advisory database
Timeline
29 Sep24 daysfrom publication to Patchwire
- Published by GitHub advisory database29 Sep
- Seen by Patchwire23 Oct
- Fix released29 Sep
undici7.29.18.10.2
Versions of undici
8.x
safe 8.10.2
7.x
safe 7.29.1
AffectedSafe
Related alerts(8)
Same packagesExploitable only if · read by Claude, the source remains the reference
- Project uses undici 6.x before 6.29.1, 7.x before 7.30.1, or 8.x before 8.12.2.
- Application calls undici's fetch() against servers that may be attacker-controlled or malicious.
- The server responds with more than five content codings and closes the connection before sending the body.
- Affected
- undici >=6.23.0 <6.29.1 · undici >=7.18.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-xjj6-f33q-929c
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici's EventSource client.
- undici version is below 6.29.1, 7.30.1, or 8.12.2 in the respective major line.
- The application maintains an EventSource connection to an untrusted or potentially compromised Server-Sent Events peer that controls the response.
- Affected
- undici >=6.5.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-4qv8-2p9j-2685
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at version 7.15.0 or later, below the patched releases 7.30.1 / 8.12.2.
- Application calls undici's fetch() with Subresource Integrity (integrity) metadata.
- The integrity metadata uses an uppercase or mixed-case algorithm token (e.g. SHA256- or Sha256-).
- An attacker can control the response body returned by the server.
- Affected
- undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-f72v-6w45-q472
Exploitable only if · read by Claude, the source remains the reference
- undici version is 7.x before 7.30.1 or 8.x before 8.12.2.
- An originless Agent dispatcher is used (not an origin-bound Client or Pool).
- Interceptors are composed as compose(redirect(), cache()) (not compose(cache(), redirect())).
- The cache interceptor uses a shared cache (type: 'shared') backed by a MemoryCacheStore or SqliteCacheStore.
- Requests can follow redirects whose targets can be attacker-controlled or user-specific (e.g. cross-origin or private/no-store redirects).
- Affected
- undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-4w7w-5xrc-9h26
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at a version before 6.29.1, 7.30.1, or 8.12.2.
- Requests are made through undici's Agent (including as default dispatcher for request, fetch, setGlobalDispatcher) or EnvHttpProxyAgent on direct/NO_PROXY routes.
- The Agent is constructed with a function-valued tls option, such as a custom checkServerIdentity callback for certificate or public-key pinning.
- The TLS options are passed via the tls option rather than via connect.
- Affected
- undici >=4.0.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-2m5v-pch6-74hx
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici (directly or via Node.js global fetch()) at a version before 6.29.1, 7.30.1, or 8.12.2.
- The client makes HTTPS requests to an endpoint that is malicious or compromised.
- The connection to that endpoint negotiates TLS 1.2 (not restricted to TLS 1.3).
- The server initiates renegotiation after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host.
- Affected
- undici >=4.2.1 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-qrxm-fqhp-jwvm
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici's WebSocket client (directly or via Node.js's bundled globalThis.WebSocket).
- Installed undici version is 5.15.0 or later in the 5.x line, or a 6.x, 7.x, or 8.x release earlier than 6.29.1, 7.30.1, or 8.12.2 respectively.
- The client connects to a WebSocket server that is malicious or compromised and can stream PING frames without reading PONG responses.
- Affected
- undici >=5.15.0 <6.29.1 · undici >=7.0.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 6.29.1 · 7.30.1 · 8.12.2
- ID
- GHSA-9fm3-97px-rjf6
Exploitable only if · read by Claude, the source remains the reference
- Project uses undici at a version before 7.30.1 (7.x) or before 8.12.2 (8.x).
- The client composes undici's decompress interceptor with a downstream response handler that throws during response processing (e.g. the dump interceptor with maxSize).
- The client makes requests to an HTTP server that may be malicious or compromised and can return a compressed body that decompresses beyond the configured limit.
- Affected
- undici >=7.15.0 <7.30.1 · undici >=8.0.0 <8.12.2
- Fixed in
- 7.30.1 · 8.12.2
- ID
- GHSA-55wc-3pg8-jfw6